Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Dec 1st, 2008, 8:47pm
   Mischel Internet Security Forum
   TrojanHunter
   TrojanHunter Scanner (Moderators: Helena, Gavin_Coe, Magnus)
   unupx.dll added on 16-Oct-2007		 « Previous topic | Next topic »
Pages: 1 2  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: unupx.dll added on 16-Oct-2007  (Read 1026 times)
Jrb
Full Member
***



I love YaBB 1G - SP1!

   


Posts: 221
unupx.dll added on 16-Oct-2007
« on: Oct 16th, 2007, 3:28pm »		 Quote Quote  Modify Modify
Hi,
 
I noticed that this file was just added:
 
c:\program files\trojanhunter 5.0\rulefiles\unupx.dll
 
May I ask Magnus and Gavin whether this is related to my question here:
http://www.misec.net/forum/board/RulesetUpdates/1192503517
 
where I posted a suddenly drop in the number of ruleset entries?
 
Thanks in advance !
 
Cheers, Jan.
 
« Last Edit: Oct 16th, 2007, 4:58pm by Jrb » IP Logged
Jrb
Full Member
***



I love YaBB 1G - SP1!

   


Posts: 221
Re: unupx.dll added on 16-Oct-2007
« Reply #1 on: Oct 16th, 2007, 4:57pm »		 Quote Quote  Modify Modify
I have now two files unupx.dll
 
Here are their full paths and MD5 checksum:
 
1.
 
C:\Program Files\TrojanHunter 5.0\UnUpx.dll  
 
MD5      - 3C808B4AE2321FF8CBE26492B7782B22
 
2.
 
C:\Program Files\TrojanHunter 5.0\RuleFiles\UnUpx.dll  
 
MD5      - 28EDB2BE2ACA0749625B31FD1D70C20B
« Last Edit: Oct 16th, 2007, 4:59pm by Jrb » IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4120
Re: unupx.dll added on 16-Oct-2007
« Reply #2 on: Oct 16th, 2007, 5:05pm »		 Quote Quote  Modify Modify
Yes, the UnUpx dll was updated. However, the update server placed it in the RuleFiles folder when it should have gone in the TrojanHunter folder. I have now fixed this so the file will be downloaded to the TrojanHunter folder next time. The MD5 sums are the same as we have here  Smiley
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4120
Re: unupx.dll added on 16-Oct-2007
« Reply #3 on: Oct 16th, 2007, 5:05pm »		 Quote Quote  Modify Modify
For those interested, the change is that TrojanHunter can now unpack UPX 3.0-packed files.
IP Logged
Jrb
Full Member
***



I love YaBB 1G - SP1!

   


Posts: 221
Re: unupx.dll added on 16-Oct-2007
« Reply #4 on: Oct 16th, 2007, 6:41pm »		 Quote Quote  Modify Modify
on Oct 16th, 2007, 5:05pm, Magnus wrote:
Yes, the UnUpx dll was updated. However, the update server placed it in the RuleFiles folder when it should have gone in the TrojanHunter folder. I have now fixed this so the file will be downloaded to the TrojanHunter folder next time. The MD5 sums are the same as we have here  Smiley

 
Magnus,
 
May I ask for exact information on this !
 
I want exact information about :
 
1.
Whether there should be two files unupx.dll
 
2.
If so, where in the TH folder?
 
3.
For each of those files, if there are more than one of those files, their full path and their MD5 checksum.
 
With all due respect, you have to give all of that info!
 
Regards,
Jan.
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4120
Re: unupx.dll added on 16-Oct-2007
« Reply #5 on: Oct 16th, 2007, 6:47pm »		 Quote Quote  Modify Modify
Jan,
 
The MD5 sums you quote are correct. One is for the old UnUpx.dll (the one that starts with 3), the other one for the new UnUpx.dll. You can delete the UnUpx.dll in your rulefiles folder. After the next update, you should have only one UnUpx.dll, in the TrojanHunter folder.
IP Logged
Jrb
Full Member
***



I love YaBB 1G - SP1!

   


Posts: 221
Re: unupx.dll added on 16-Oct-2007
« Reply #6 on: Oct 16th, 2007, 7:10pm »		 Quote Quote  Modify Modify
on Oct 16th, 2007, 6:47pm, Magnus wrote:
Jan,
 
The MD5 sums you quote are correct. One is for the old UnUpx.dll (the one that starts with 3), the other one for the new UnUpx.dll. You can delete the UnUpx.dll in your rulefiles folder. After the next update, you should have only one UnUpx.dll, in the TrojanHunter folder.

 
Hi Magnus,
 
Are you really sure......
I did not ask it for nothing.....
I did ask for exact info !
 
Here you are, using file-integrity-checker NISFileCheck which uses RMD160 but I will add MD5.
 
New was added:
 
Application: c:\program files\trojanhunter 5.0\rulefiles\unupx.dll
Status:  New added
Version old: N/A
Size old: 126123
Date old: 2007-10-16  21:50:14
RMD160 Hash old: 5CF52106D545894D0D98642A38AF6EB2936508BD
 
MD5 :  
The file C:\Program Files\TrojanHunter 5.0\RuleFiles\UnUpx.dll has the following Checksum(s)
 
MD5 - 28EDB2BE2ACA0749625B31FD1D70C20B
 
 
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4120
Re: unupx.dll added on 16-Oct-2007
« Reply #7 on: Oct 16th, 2007, 7:27pm »		 Quote Quote  Modify Modify
MD5 for new UnUpx.dll: 28EDB2BE2ACA0749625B31FD1D70C20B
MD5 for old UnUpx.dll: 3C808B4AE2321FF8CBE26492B7782B22
 
IP Logged
Jrb
Full Member
***



I love YaBB 1G - SP1!

   


Posts: 221
Re: unupx.dll added on 16-Oct-2007
« Reply #8 on: Oct 16th, 2007, 11:27pm »		 Quote Quote  Modify Modify
Thank you Magnus.
 
In general:
As Joseph V. Morris and me have said time and time again, it is not sufficient to give only file-names or paths or (MD5) checksums alone. You have to give complete and exact info; if you don't, it is (almost) useless.
Well, after that having said:
 
1.
 
I decided after all this mess to do a fresh clean install of TH,
on XP-home SP2 Dutch.
TH was uninstalled and the TH folder was deleted by me.
 
2.
 
I downloaded a new install file.
This install file was the same as for the previous build and not for the latest build 961 as far as I know.
Prove from NISFileCheck:
 
2-a.
Application: d:\trojanhunter\version 5_0 build 950\trojanhuntersetup.exe
Status:  Unchanged
Size old: 14463048
Date old: 2007-09-13  04:51:44
RMD160 Hash old: A2D6E289CDD04A268425C5C318577383F51865B7
 
2-b.
Application: d:\trojanhunter\version 5_0 build 961 2007_10_17\trojanhuntersetup.exe
Status:  Unchanged
Size old: 14463048
Date old: 2007-10-17  02:52:14
RMD160 Hash old: A2D6E289CDD04A268425C5C318577383F51865B7
 
PS:
MD5 checksum:  
The file D:\TrojanHunter\Version 5_0 Build 961 2007_10_17\TrojanHunterSetup.exe has the following Checksum(s)
MD5 - 8D892E1C751EAE148DEE039F17990512
 
3.
 
I installed it while being off-line.
 
4.
 
I rebooted and got on-line.
I checked for TH updates.
 
5.
 
TH is now again at build 961.
 
6.
 
As for the two files unupx.dll :
 
6-a.
 
This file does NOT indeed exist anymore:
c:\program files\trojanhunter 5.0\rulefiles\unupx.dll
 
Prove of NISFileCheck:
Application: c:\program files\trojanhunter 5.0\rulefiles\unupx.dll
Status:  Changed: (Deleted, File not found error)
Version old: N/A
Size old: 126123
Date old: 2007-10-16  21:50:14
RMD160 Hash old: 5CF52106D545894D0D98642A38AF6EB2936508BD
 
6-b.
 
This file has been changed:
c:\program files\trojanhunter 5.0\unupx.dll
 
Prove of NISFileCheck:
Application: c:\program files\trojanhunter 5.0\unupx.dll
Status:  Changed
Version old: N/A
Version new: N/A
Size old: 46592
Size new: 126123
Date old: 2006-06-05  16:51:46
Date new: 2007-10-17  03:15:24
RMD160 Hash old: 5D4B01A4B9796795915FC7DAD9E3220429E1E47B
RMD160 Hash new: 5CF52106D545894D0D98642A38AF6EB2936508BD
 
with MD5 checksum:
The file C:\Program Files\TrojanHunter 5.0\UnUpx.dll has the following Checksum(s)
MD5 - 28EDB2BE2ACA0749625B31FD1D70C20B
 
IP Logged
Brian49
Junior Member
**





   


Posts: 71
Re: unupx.dll added on 16-Oct-2007
« Reply #9 on: Oct 18th, 2007, 8:16am »		 Quote Quote  Modify Modify
The version of this file in my main TrojanHunter folder has not been updated recently. I run an update manually at least once a day, from the US server.
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4120
Re: unupx.dll added on 16-Oct-2007
« Reply #10 on: Oct 18th, 2007, 8:24am »		 Quote Quote  Modify Modify
Program updates are not included in the manual update files. You need to run LiveUpdate to get them.
IP Logged
Brian49
Junior Member
**





   


Posts: 71
Re: unupx.dll added on 16-Oct-2007
« Reply #11 on: Oct 18th, 2007, 6:26pm »		 Quote Quote  Modify Modify
There seems to be a misunderstanding here - when I said that I run the update manually, I simply meant that I don't have it set up as a scheduled task. I use the LiveUpdate feature, from the US server.
IP Logged
Gavin_Coe
Trojan Analyst
*****





   
WWW  

Gender: male
 Posts: 2113
Re: unupx.dll added on 16-Oct-2007
« Reply #12 on: Oct 18th, 2007, 9:53pm »		 Quote Quote  Modify Modify
OK I think I know what has happened
 
Did you get a LiveUpdate error unable to replace file? if TrojanHunter.exe is scanning the updater doesn't seem to want to replace it Grin its a bug and must be involved I think Smiley
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: unupx.dll added on 16-Oct-2007
« Reply #13 on: Oct 19th, 2007, 3:40am »		 Quote Quote  Modify Modify
Brian49
 
Please try forcing a complete download of the updates (rulesets and program revisions)  
 
1.  Unload THGuard.exe from memory.  Be sure TrojanHunter scanner is closed down.  
 
2.  Using Windows Explorer, navigate to the RuleFiles folder at C:\Program Files\TrojanHunter 5.0\RuleFiles and open the folder.  
 
3.  Delete file  UpdateList.txt  
 
4.  Close Windows Explorer  
 
5.  Go to START>Programs>TrojanHunter and run LiveUpdate.  
 
LiveUpdate will download a complete RuleSets plus UnUpx.dll, THGuard.exe and TrojanHunter.exe  
 
6.  Restart THGuard.exe  
 
7.  TrojanHunter.exe should now be Build 961  
 
8.  UnUpx.dll should be the new version.
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
Brian49
Junior Member
**





   


Posts: 71
Re: unupx.dll added on 16-Oct-2007
« Reply #14 on: Oct 19th, 2007, 3:43am »		 Quote Quote  Modify Modify
No, there hasn't been any error message, and scanning isn't in progress at the time of running LiveUpdate. The version of the file in my TH folder is dated 5 June 2006.
IP Logged
Pages: 1 2  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register